Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @rust@social.rust-lang.org
rukai :rust:@rukai@hachyderm.io (2026-08-20 19:41:48)
@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.
---Reply---
Rust Language@rust@social.rust-lang.org (2026-08-20 20:02:07)
@rukai The malicious dependency (`proc-macro1`) was published today at 01:55 UTC. We deleted it six hours later at 08:03 UTC.

We'll also investigate the publication times of the affected crates (`arrayref` etc.) and add this information to the blog post.